National Strategy for Trusted Identities in Cyberspace Proposer’s Conference 15 February 2012

1. National Strategy for Trusted Identities in CyberspaceProposer’s Conference15 February 2012

2. Agenda9:00 Welcome and Introduction9:15 NSTIC Overview and Status UpdateJeremy Grant, Senior Executive Advisor for Identity Management 9:45 Pilots Program – Purpose and ScopeJeremy Grant, Senior Executive Advisor for Identity Management10:15 Overview of the Pilot Projects Federal Funding OpportunityBarbara Cuthill, NSTIC Grants Lead10:45 Break11:00 Administrative RequirementsBarbara Cuthill, NSTIC Grants Lead11:15 Questions and Answers

3. National Strategy for Trusted Identities in CyberspaceJeremy Grant NIST

4. What is NSTIC? • Called for in President’s Cyberspace Policy Review (May 2009): a “cybersecurity focused identity management vision and strategy…that addresses privacy and civil-liberties interests, leveraging privacy-enhancing technologies for the nation.” Guiding Principles • Privacy-Enhancing and Voluntary • Secure and Resilient • Interoperable • Cost-Effective and Easy To Use NSTIC calls for an Identity Ecosystem, “an online environment where individuals and organizations will be able to trust each other because they follow agreed upon standards to obtain and authenticate their digital identities.”

5. The Problem Today Usernames and passwords are broken • Most people have 25 different passwords, or use the same one over and over • Even strong passwords are vulnerable…criminals can get the “keys to the kingdom” • Rising costs of identity theft • 8.1M U.S. victims in 2010 at a cost of $37 billion (Javelin) • A common vector of attack • Sony Playstation, Zappos, Lulzsec, Infragard among dozens of 2011-12 breaches tied to passwords.

6. The Problem Today Source: 2011 Data Breach Investigations Report, Verizon and USSS

7. The Problem Today Identities are difficult to verify over the internet • Numerous government services still must be conducted in person or by mail,leading to continual rising costs for state, local and federal governments • Electronic health records could save billions, but can’t move forward without solving authentication challenge for providers and individuals • Many transactions, such as signing an auto loan or a mortgage, are still considered too risky to conduct online due to liability risks Rob Cottingham, June 23, 2007 New Yorker, September 12, 2005 New Yorker, July 5, 1993

8. The Problem Today Privacy remains a challenge • Individuals often must provide more personally identifiable information (PII) than necessary for a particular transaction • This data is often stored, creating “honey pots” of information for cybercriminals to pursue • Individuals have few practical means to control use of their information

9. Personal Data is Abundant…and Growing

10. Trusted Identities provide a foundation • Enable new types of transactions online • Reduce costs for sensitive transactions • Offer citizens more control over when and how data is revealed • Share minimal amount of information • Fight cybercrime and identity theft • Increased consumer confidence

11. January 1, 2016 The Identity Ecosystem: Individuals can choose among multiple identity providers and digital credentials for convenient, secure, and privacy-enhancing transactions anywhere, anytime. Online shopping with minimal sharing of PII Apply for mortgage online with e-signature Cost-effectiveand easy to use Privacy-enhancing Secure Interoperable Trustworthy critical service delivery Secure Sign-On to state website Security ‘built-into’ system to reduce user error Privately post location to her friends

12. We've proven that Trusted Identities matter

13. What does NSTIC call for?

14. Privacy and Civil Liberties are Fundamental • Increase privacy • Minimize sharing of unnecessary information • Minimum standards for organizations - such as adherence to Fair Information Practice Principles (FIPPs) • Voluntary and private-sector led • Individuals can choose not to participate • Individuals who participate can choose from public or private-sector identity providers • No central database is created • Preserves anonymity • Digital anonymity and pseudonymity supports free speech and freedom of association

15. NSTIC National Program Office • Charged with leading day-to-day coordination across government and the private sector in implementing NSTIC • Funded with $16.5M for FY12

16. Next Steps

17. The Time is Now • Needs a nudge towards interoperability & standardization • Needs clarity on national policy/legal framework (e.g. liability and privacy) • Needs an early adopter to stimulate demand • Government can meet these needs to facilitate private sector

18. National Strategy for Trusted Identities in CyberspacePilots Program – Purpose and Scope Jeremy Grant NIST

19. Pilot Overview • Purpose • Advance the NSTIC vision, objectives and guiding principles • Demonstrate innovative frameworks that can provide a foundation for the Identity Ecosystem, and tackle barriers that have, to date, impeded the Identity Ecosystem from being fully realized.

20. Pilot Overview • “Make something happen that otherwise would not” • Pilots should test or demonstrate new solutions, models or frameworks that do not exist in the marketplace today… • …and that would be unlikely to exist – at least in a way that supports NSTIC – without this pilot funding

21. Focus on Barriers • The identity solutions marketplace has struggled, in part, due to a number of barriers that market forces alone have been unable to overcome. These barriers include, but are not limited to: • A lack of commonly accepted technical standards to ensure interoperability among different authentication solutions. • No clarity on liability and other complex economic issues (i.e., “who is liable if something goes wrong in a transaction?” “How – if at all – should transactions be monetized?”) • No common standards for privacy protections and data re-use. • Challenges with usability of some strong authentication technologies.

22. Focus on Barriers • The NSTIC National Program Office (NPO) seeks to overcome these barriers, in part, through funding pilot programs that provide creative solutions to address one or more of these barriers and demonstrate the feasibility of solutions to them in a manner consistent with the NSTIC vision and guiding principles. • These pilots can thus provide a foundation upon which the Identity Ecosystem can be constructed.

23. A Challenge-based Approach • The FFO lays out 12 objectives that are “challenges” for potential proposers to solve. • Proposers are not limited to addressing these 12 challenges in their proposals – there are certainly other notable challenges which may be worthy of attention. • The 12 objectives do provide a starting point for proposers to consider.

24. Examples • Demonstrate the feasibility of the Identity Ecosystem, via projects that link multiple sectors, including multiple Identity providers and relying parties. • Create and demonstrate solutions that can help public and private sector entities alike more easily jumpstart adoption of trusted strong authentication technologies in lieu of passwords at public-facing websites. For example, identity exchange hubs that can quickly validate and process strong credentials for relying parties. • Create solutions to address the limitations and barriers that have inhibited consumer demand for strong authentication technologies, and that could prompt consumers to obtain a strong credential.

25. Examples • Create and demonstrate a viable framework, capable of being accepted by all stakeholders, that provides certainty on liability and other economic issues. • Create and demonstrate a viable framework, capable of being accepted by all stakeholders, that provides a strong set of user-centric privacy protections for all Identity Ecosystem participants. • Demonstrate that privacy-enhancing technologies can support viable business models, current security requirements, and generally accepted performance standards.

26. Examples • 7. Demonstrate interoperability across multiple-solution stacks (i.e., smart cards, one time passwords, other technologies) in an identity ecosystem. • 8. Create and demonstrate better user-centric frameworks for enabling the exchange of specific attributes associated with identities. • 9. Expand the acceptance and use of trust frameworks and trusted third party credential providers by new Relying Parties.

27. Examples • 10. Demonstrate that end-user choice can align with usability through innovative presentations of choice and new types of interfaces. • 11. Demonstrate how advances in usability and accessibility can improve user uptake of strong authentication technologies. • 12. Demonstrate the role public sector entities can play in helping individuals prove their identity to private sector credential providers and/or relying parties.

28. Funding • A total of $10,000,000 may be made available in FY 2012 • We anticipate awarding five (5) to eight (8) awards. • New awards are expected to range from approximately $1,250,000 to $2,000,000 each with project performance periods of up to two (2) years • Initial funding only provided for first year

29. Funding • A note on the ranges: • With regard to the $1.25-2M range: proposers may request smaller or larger amounts – the range above is simply what we forecast. • Two years is the maximum we would consider for a period of performance – entities who can demonstrate meaningful outcomes in a shorter timeframe should propose to do so.

30. National Strategy for Trusted Identities in Cyberspace Overview of the Federal Funding Opportunity http://www.nist.gov/director/oism/index.cfm http://www.nist.gov/director/oism/index.cfm

31. Contents • Eligibility • Cost-Share • Structure and Timeline • Evaluation Process • Evaluation Criteria • Selection Factors • Abbreviated Proposal Contents • Full Proposal Contents

32. Who is an eligible proposer? • Accredited institutions of higher education; • Hospitals; • Non-profit organizations; • Commercial organizations; and • State, local, and Indian tribal governments located in the United States and its territories.

33. Who is not eligible? • Individuals; • Federal government entities; and • Entities located outside the U.S.

34. Cost-Share • Cost-share is not required

35. CompetitionStructure and Timeline • Abbreviated Proposals due March 7, 2012 • Finalist notifications – March 22, 2012 • Full Proposals due April 23, 2012 • Selections – July, 2012 • Earliest Potential Start Date – September 1, 2012

36. Abbreviated Proposal Evaluation Process • Administrative Review • Eligibility • Completeness • Responsiveness to the Scope • Technical Review • Uses the Evaluation Criteria • At least three independent reviews • Proposals ranked using average scores • Selection made using rank and selection factors

37. Full Proposal Evaluation Process • Administrative Review • Eligibility • Completeness • Responsiveness to the Scope • Technical Review • Uses the same Evaluation Criteria • At least three independent reviews • Evaluation Panel reads proposals and technical reviews and ranks the proposals • Selection made using rank and selection factors

38. Evaluation Criteria • Rationality and Feasibility (0 to 40 points) • Merit of Contribution (0 to 30 points) • Qualifications of Personnel and Ability to Deliver (0 to 20 points) • Resource Availability and Planning (0 to 10 points)

39. Rationality and Feasibility • Rationality and Feasibility (0 to 40 points). Coherence of the proposer’s approach and the extent to which the proposal effectively addresses the NSTIC Guiding Principles. Factors that may be considered include: • demonstration of long-term commitment to project success; • demonstrated alignment of pilot to NSTIC guiding principles; • the thoughtful integration of usability principles and user-centered design; • how enhancement of end-user privacy is designed into the project; • the ability to address differences between conformity and interoperability; • the ability to identify clearly, technology versus policy interoperability efforts; • the ability to address identified barriers to the Identity Ecosystem and provide a foundation to address one or more of them; • the likelihood that the pilot would be successful; • the likelihood that the pilot, if successful, could continue into production; and • the quality and comprehensiveness of a plan to transition a pilot into ongoing operations, i.e., “production.”

40. Merit of Contribution • Merit of Contribution (0 to 30 points). Potential effectiveness of the proposal and the value it would contribute to furthering the development of the Identity Ecosystem in accordance with the NSTIC Guiding Principles. Factors that may be considered include: • the likelihood that the proposed project will help meet NSTIC near-term or long-term benchmarks; • the contribution of the project to development of the Identity Ecosystem Framework; • the number of end users potentially impacted by the proposed project; and • the ability of the proposed project to develop new or strengthen existing digital identity services.

41. Qualifications of Personnel and Ability to Deliver • Qualifications of Personnel and Ability to Deliver (0 to 20 points). Professional accomplishments, skills and training of the proposed personnel to perform the work described in the project. Factors that may be considered include: (1) the qualifications of key and supporting personnel; (2) demonstration of the ability to achieve positive outcomes in pilot programs and similar endeavors; and (3) stakeholder outreach and coordination.

42. Resource Availability and Planning • Resource Availability and Planning (0 to 10 points). Extent to which the proposer has access to the necessary facilities and overall support to accomplish the project objectives. Factors that may be considered include: •  the degree to which requested resources are appropriate for the proposed project’s scope; • the quality of organizational resources proposed to be used on the project; • the rationality of acquisition plans; • the plan to obtain and/or leverage additional or external resources or support as needed to complete the project and/or to engage in post-project commercialization to move the project results into routine use; • the effectiveness of the organizational proposed team structure if contracts and/or sub-awards are included; and • proposed collaborations with other Identity Ecosystem stakeholders.

43. Selection Factors • The availability of Federal funds. • The project duplicates other projects funded by NIST, DoC, or by other Federal agencies. • Proposer’s performance under current or previous Federal financial assistance awards. • Diversity of technical approaches to providing a foundation for the Identity Ecosystem, and tackling barriers that have, to date, impeded the Identity Ecosystem from being fully realized.

44. Abbreviated Proposal Contents • SF-424, Application for Federal Assistance. • Signed by an authorized representative of the proposer organization • FFO number 2012-NIST-NSTIC-01 in item 12 • All other information provided • Abbreviated Project Narrative • Word-processed document • No more than five (5) double-spaced pages • Includes sufficient information to address the evaluation criteria

45. Full Proposal Contents • SF-424, Application for Federal Assistance. • Signed by an authorized representative of the proposer organization • FFO number 2012-NIST-NSTIC-01 in item 12 • Requires • Central Contractor Registry Number (CCR) • Dun and Bradstreet Number (DUNS) • Employer Identification Number (EIN) CCR, DUNS and EIN numbers are required for award and for filing proposals electronically through grants.gov. For a start up without any of these numbers, it can take weeks to get all three.

46. Full Proposal Contents – Cont. • SF-424A, Budget Information - Non-Construction Programs. • The budget should reflect anticipated expenses for each year of the project of no more than two (2) years, considering all potential cost increases, including cost of living adjustments.) • SF-424B, Assurances - Non-Construction Programs • CD-511, Certification Regarding Lobbying • SF-LLL, Disclosure of Lobbying Activities (if applicable)

47. Full Proposal Contents - Continued Full Technical Proposal. • Word-processed document • No more than twenty-five (25) pages • Responsive to the program description and the evaluation criteria • Contains the following: Executive Summary Project Approach Statement of Work Qualifications Resource Availability 47

48. National Strategy for Trusted Identities in Cyberspace Administrative Requirements 48

49. Contents • Budget Information • Payment • Partnering Tools – Contracts and Sub-awards • Intellectual Property • Human Subjects and Software Testing • Expectations and Reporting Requirements for Cooperative Agreements

50. Budget Information - Cost Principles • 48 CFR Part 31 (For-profits) – http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&tpl=/ecfrbrowse/Title48/48cfr31_main_02.tpl • 2 CFR Part 220 - Educational Institutions (OMB Circular A-21) - http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&tpl=/ecfrbrowse/Title02/2cfr220_main_02.tpl • 2 CFR Part 225 - State and Local Governments - http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&tpl=/ecfrbrowse/Title02/2cfr225_main_02.tpl • 2 CFR Part 230 - Non-profits (OMB Circular A-122) - http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&tpl=/ecfrbrowse/Title02/2cfr230_main_02.tpl